Mercurial > prosody-modules
view mod_pubsub_stats/mod_pubsub_stats.lua @ 5682:527c747711f3
mod_http_oauth2: Limit revocation to clients own tokens in strict mode
RFC 7009 section 2.1 states:
> The authorization server first validates the client credentials (in
> case of a confidential client) and then verifies whether the token was
> issued to the client making the revocation request. If this
> validation fails, the request is refused and the client is informed of
> the error by the authorization server as described below.
The first part was already covered (in strict mode). This adds the later
part using the hash of client_id recorded in 0860497152af
It still seems weird to me that revoking a leaked token should not be
allowed whoever might have discovered it, as that seems the responsible
thing to do.
author | Kim Alvefur <zash@zash.se> |
---|---|
date | Sun, 29 Oct 2023 11:30:49 +0100 |
parents | b2ce818ec19c |
children |
line wrap: on
line source
local st = require "util.stanza"; local pubsub = module:depends"pubsub"; local actor = module.host .. "/modules/" .. module.name; local pubsub_xmlns = "http://jabber.org/protocol/pubsub" local node = module:get_option_string(module.name .. "_node", "stats"); local function publish_stats(stats, stats_extra) local id = "current"; local xitem = st.stanza("item", { xmlns = pubsub_xmlns, id = id }) :tag("query", { xmlns = "http://jabber.org/protocol/stats" }); for name, value in pairs(stats) do local stat_extra = stats_extra[name]; local unit = stat_extra and stat_extra.units; xitem:tag("stat", { name = name, unit = unit, value = tostring(value) }):up(); end local ok, err = pubsub.service:publish(node, actor, id, xitem); if not ok then module:log("error", "Error publishing stats: %s", err); end end function module.load() pubsub.service:create(node, true, { persistent_items = false; max_items = 1; }); pubsub.service:set_affiliation(node, true, actor, "publisher"); end module:hook_global("stats-updated", function (event) publish_stats(event.stats, event.stats_extra); end); function module.unload() pubsub.service:delete(node, true); end module:hook("pubsub-summary/http://jabber.org/protocol/stats", function (event) local payload = event.payload; local summary = {}; for stat in payload:childtags("stat") do if stat.attr.name and stat.attr.value then table.insert(summary, string.format("%s: %g %s", stat.attr.name, tonumber(stat.attr.value), stat.attr.units or "")); end end table.sort(summary); return table.concat(summary, "\n"); end);